Multiple vulnerabilities in Intel Thunderbolt Controllers

1) Input validation error

EUVDB-ID: #VU54116

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-12293

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper control of a resource. A local user can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Intel Thunderbolt DSL5520: All versions

Intel Thunderbolt DSL5320: All versions

Intel Thunderbolt DSL6340: All versions

Intel Thunderbolt DSL6540: All versions

Intel Thunderbolt JHL6540: before 46

Intel Thunderbolt JHL6340: before 46

Intel Thunderbolt JHL6240: before 21

Intel Thunderbolt JHL7540: before 60

Intel Thunderbolt JHL7340: before 60

Intel Thunderbolt JHL7440: before 60

Intel Thunderbolt JHL8040R: before 41

Intel Thunderbolt JHL8010R: before 41

Intel Thunderbolt JHL7040: before 22

External links

http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU54117

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-12294

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient control flow management. A local user can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Intel Thunderbolt DSL5520: All versions

Intel Thunderbolt DSL5320: All versions

Intel Thunderbolt DSL6340: All versions

Intel Thunderbolt DSL6540: All versions

Intel Thunderbolt JHL6540: before 46

Intel Thunderbolt JHL6340: before 46

Intel Thunderbolt JHL6240: before 21

Intel Thunderbolt JHL7540: before 60

Intel Thunderbolt JHL7340: before 60

Intel Thunderbolt JHL7440: before 60

Intel Thunderbolt JHL8040R: before 41

Intel Thunderbolt JHL8010R: before 41

Intel Thunderbolt JHL7040: before 22

External links

http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Input validation error

EUVDB-ID: #VU54118

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-12295

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation. A local user can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Intel Thunderbolt DSL5520: All versions

Intel Thunderbolt DSL5320: All versions

Intel Thunderbolt DSL6340: All versions

Intel Thunderbolt DSL6540: All versions

Intel Thunderbolt JHL6540: before 46

Intel Thunderbolt JHL6340: before 46

Intel Thunderbolt JHL6240: before 21

Intel Thunderbolt JHL7540: before 60

Intel Thunderbolt JHL7340: before 60

Intel Thunderbolt JHL7440: before 60

Intel Thunderbolt JHL8040R: before 41

Intel Thunderbolt JHL8010R: before 41

Intel Thunderbolt JHL7040: before 22

External links

http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Resource exhaustion

EUVDB-ID: #VU54119

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-12296

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Intel Thunderbolt DSL5520: All versions

Intel Thunderbolt DSL5320: All versions

Intel Thunderbolt DSL6340: All versions

Intel Thunderbolt DSL6540: All versions

Intel Thunderbolt JHL6540: before 46

Intel Thunderbolt JHL6340: before 46

Intel Thunderbolt JHL6240: before 21

Intel Thunderbolt JHL7540: before 60

Intel Thunderbolt JHL7340: before 60

Intel Thunderbolt JHL7440: before 60

Intel Thunderbolt JHL8040R: before 41

Intel Thunderbolt JHL8010R: before 41

Intel Thunderbolt JHL7040: before 22

External links

http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Resource exhaustion

EUVDB-ID: #VU54120

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-12291

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Intel Thunderbolt DSL5520: All versions

Intel Thunderbolt DSL5320: All versions

Intel Thunderbolt DSL6340: All versions

Intel Thunderbolt DSL6540: All versions

Intel Thunderbolt JHL6540: before 46

Intel Thunderbolt JHL6340: before 46

Intel Thunderbolt JHL6240: before 21

Intel Thunderbolt JHL7540: before 60

Intel Thunderbolt JHL7340: before 60

Intel Thunderbolt JHL7440: before 60

Intel Thunderbolt JHL8040R: before 41

Intel Thunderbolt JHL8010R: before 41

Intel Thunderbolt JHL7040: before 22

External links

http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Resource exhaustion

EUVDB-ID: #VU54121

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-12292

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper conditions check. A local user can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Intel Thunderbolt DSL5520: All versions

Intel Thunderbolt DSL5320: All versions

Intel Thunderbolt DSL6340: All versions

Intel Thunderbolt DSL6540: All versions

Intel Thunderbolt JHL6540: before 46

Intel Thunderbolt JHL6340: before 46

Intel Thunderbolt JHL6240: before 21

Intel Thunderbolt JHL7540: before 60

Intel Thunderbolt JHL7340: before 60

Intel Thunderbolt JHL7440: before 60

Intel Thunderbolt JHL8040R: before 41

Intel Thunderbolt JHL8010R: before 41

Intel Thunderbolt JHL7040: before 22

External links

http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Improper access control

EUVDB-ID: #VU54122

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-12290

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A local user can bypass implemented security restrictions and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Intel Thunderbolt DSL5520: All versions

Intel Thunderbolt DSL5320: All versions

Intel Thunderbolt DSL6340: All versions

Intel Thunderbolt DSL6540: All versions

Intel Thunderbolt JHL6540: before 46

Intel Thunderbolt JHL6340: before 46

Intel Thunderbolt JHL6240: before 21

Intel Thunderbolt JHL7540: before 60

Intel Thunderbolt JHL7340: before 60

Intel Thunderbolt JHL7440: before 60

Intel Thunderbolt JHL8040R: before 41

Intel Thunderbolt JHL8010R: before 41

Intel Thunderbolt JHL7040: before 22

External links

http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU54123

Risk: Low

CVSSv3.1: 3.3 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-12288

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to protection mechanism failure. A local user can cause a denial of service condition on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Intel Thunderbolt DSL5520: All versions

Intel Thunderbolt DSL5320: All versions

Intel Thunderbolt DSL6340: All versions

Intel Thunderbolt DSL6540: All versions

Intel Thunderbolt JHL6540: before 46

Intel Thunderbolt JHL6340: before 46

Intel Thunderbolt JHL6240: before 21

Intel Thunderbolt JHL7540: before 60

Intel Thunderbolt JHL7340: before 60

Intel Thunderbolt JHL7440: before 60

Intel Thunderbolt JHL8040R: before 41

Intel Thunderbolt JHL8010R: before 41

Intel Thunderbolt JHL7040: before 22

External links

http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Buffer overflow

EUVDB-ID: #VU54124

Risk: Low

CVSSv3.1: 3.3 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-12289

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error. A local user can trigger memory corruption and cause a denial of service condition on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Intel Thunderbolt DSL5520: All versions

Intel Thunderbolt DSL5320: All versions

Intel Thunderbolt DSL6340: All versions

Intel Thunderbolt DSL6540: All versions

Intel Thunderbolt JHL6540: before 46

Intel Thunderbolt JHL6340: before 46

Intel Thunderbolt JHL6240: before 21

Intel Thunderbolt JHL7540: before 60

Intel Thunderbolt JHL7340: before 60

Intel Thunderbolt JHL7440: before 60

Intel Thunderbolt JHL8040R: before 41

Intel Thunderbolt JHL8010R: before 41

Intel Thunderbolt JHL7040: before 22

External links

http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.